5.2 VRF-Lite & Virtual Routing Multi-Tenancy

5.2 VRF-Lite & Virtual Routing Multi-Tenancy

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 2.2.a (VRF) requires candidates to configure and verify data path virtualization technologies, specifically mastering Virtual Routing and Forwarding (VRF), VRF-Lite multi-tenant path isolation, 64-bit Route Distinguishers (RD), 64-bit Route Targets (RT), 96-bit VPNv4 address structures, and inter-VRF route leaking techniques on Cisco IOS-XE platforms.

In traditional routed networks, a router maintains a single global Routing Information Base (RIB) and a single Forwarding Information Base (FIB). Every routed interface belongs to this global table, meaning all subnets must have globally unique IP addresses and all routes are reachable unless blocked by ACLs. Virtual Routing and Forwarding (VRF) virtualizes the router at Layer 3, creating multiple independent logical routing instances within a single physical chassis.

---

1. VRF Architectural Principles: RIB & FIB Virtualization

VRF enables multi-tenancy and traffic segmentation by isolating control plane routing protocols, routing tables (RIB), forwarding tables (FIB), and ARP tables on a per-VRF basis.

+-------------------------------------------------------------------------+
|                   PHYSICAL ROUTER WITH VRF INSTANCES                    |
|                                                                         |
|   +-----------------------------------------------------------------+   |
|   |                   CISCO IOS-XE ROUTING ENGINE                   |   |
|   |                                                                 |   |
|   |   +-------------------+  +-------------------+  +-----------+   |   |
|   |   |   VRF: RED (Prod) |  |  VRF: BLUE (Guest)|  |  GLOBAL   |   |   |
|   |   |   • OSPF Process 1|  |  • EIGRP 100      |  |  • BGP    |   |   |
|   |   |   • RIB (10.1/16) |  |  • RIB (10.1/16)  |  |  • RIB    |   |   |
|   |   |   • CEF FIB Red   |  |  • CEF FIB Blue   |  |  • CEF    |   |   |
|   |   +---------|---------+  +---------|---------+  +-----|-----+   |   |
|   +-------------|----------------------|------------------|---------+   |
|                 |                      |                  |             |
|   +-------------|----------------------|------------------|---------+   |
|   |             v                      v                  v         |   |
|   |      Gi0/0/1.10             Gi0/0/1.20             Gi0/0/2      |   |
|   |      [VRF: RED]             [VRF: BLUE]           [GLOBAL]      |   |
|   +-----------------------------------------------------------------+   |
+-------------------------------------------------------------------------+

Key Architectural Characteristics

• Overlapping Address Spaces: VRF RED and VRF BLUE can both use 10.1.1.0/24 or 192.168.1.0/24 simultaneously without IP address collisions, routing ambiguity, or cross-tenant packet leakage.
• Interface Binding: Each physical interface, sub-interface, SVI, or loopback is assigned to exactly one VRF (or remains in the default global table).
• Cisco Express Forwarding (CEF) Isolation: CEF maintains a dedicated hardware FIB and adjacency table for each VRF, ensuring wire-rate hardware switching in ASICs without control-plane CPU lookups.
• Independent Dynamic Routing: Independent OSPF, EIGRP, BGP, or static routing processes can be instantiated inside each VRF.

---

2. VRF-Lite vs. Full MPLS VPN Architectures

When deploying VRFs across an enterprise network, engineers choose between VRF-Lite (pure Layer 3 segmentation) and MPLS / MP-BGP VPNs (label-switched core).

+-------------------------------------------------------------------------+
|                       VRF-LITE HOP-BY-HOP TRANSPORT                     |
|                                                                         |
|    [ Router A ] ========= 802.1Q Trunk =========> [ Router B ]          |
|   +------------+   Sub-int .10 (VRF RED)         +------------+         |
|   | VRF RED    |---------------------------------| VRF RED    |         |
|   | VRF BLUE   |---------------------------------| VRF BLUE   |         |
|   +------------+   Sub-int .20 (VRF BLUE)        +------------+         |
|                                                                         |
|   (Requires per-VRF sub-interfaces & routing instances on EVERY hop)    |
+-------------------------------------------------------------------------+
|                       MPLS L3VPN OVERLAY TRANSPORT                      |
|                                                                         |
|    [ PE Router 1 ] ====== MPLS Core (P Routers) =====> [ PE Router 2 ]  |
|   +---------------+   MP-BGP VPNv4 BGP Session        +---------------+ |
|   | VRF RED (RD1) |===================================| VRF RED (RD1) | |
|   | VRF BLUE(RD2) |  2-Label Stack (BGP VPN + LDP)    | VRF BLUE(RD2) | |
|   +---------------+                                   +---------------+ |
|                                                                         |
|   (Core P routers know nothing about VRFs; pure label switching)        |
+-------------------------------------------------------------------------+

Architectural Comparison

---

3. Route Distinguishers (RD) & VPNv4 Addressing Mechanics

In multi-tenant environments where distinct customers or departments use identical private RFC 1918 subnets (e.g., both Tenant RED and Tenant BLUE use 10.1.1.0/24), routing protocols like BGP cannot distinguish between the prefixes if exchanged globally.

A Route Distinguisher (RD) is an 8-byte (64-bit) identifier prepended to a standard 32-bit IPv4 address to convert it into a globally unique 12-byte (96-bit) VPNv4 address (RFC 4364).

+-------------------------------------------------------------------------+
|                    VPNv4 96-BIT ADDRESS COMPOSITION                     |
|                                                                         |
|   |<----------------------- 12 Bytes (96 Bits) ---------------------->| |
|   |                                                                   | |
|   +---------------------------------------+---------------------------+ |
|   |     Route Distinguisher (RD)          |    IPv4 Prefix Address    | |
|   |         8 Bytes (64 Bits)             |     4 Bytes (32 Bits)     | |
|   +---------------------------------------+---------------------------+ |
|   |  Type (2B)  |   Administrator (4B/2B) |   Assigned Number (2B/4B) | |
|   +---------------------------------------+---------------------------+ |
|                                                                         |
|   Example VPNv4 Prefix: 65001:100:10.1.1.0/24                           |
+-------------------------------------------------------------------------+

RD Formats (RFC 4364)

1. Type 0 (2-byte ASN : 4-byte Number): 65001:100
2. Type 1 (4-byte IPv4 Address : 2-byte Number): 192.168.1.1:10
3. Type 2 (4-byte ASN : 2-byte Number): 655360:1

Critical Rule: The Route Distinguisher serves only one purpose: making an IPv4 prefix globally unique within BGP. The RD does NOT determine which VRF table the route will be installed into.

---

4. Route Targets (RT) & BGP Extended Communities

While the RD provides address uniqueness, Route Targets (RT) provide policy-based route distribution and membership control.

A Route Target is an 8-byte (64-bit) BGP Extended Community (RFC 4360) attached to VPNv4 routes to dictate how routes are exported from and imported into VRF routing tables.

+-------------------------------------------------------------------------+
|                    ROUTE TARGET IMPORT & EXPORT DYNAMICS                |
|                                                                         |
|   +-------------------+                     +-------------------+       |
|   |     VRF: RED      |                     |    VRF: BLUE      |       |
|   |  Export RT: 100:1 |=========\           |  Export RT: 200:1 |       |
|   |  Import RT: 100:1 |         \           |  Import RT: 200:1 |       |
|   +-------------------+          \         / +-------------------+      |
|                                   v       v                             |
|                       +-------------------------------+                 |
|                       |  MP-BGP VPNv4 Routing Engine  |                 |
|                       |  - Stores all VPNv4 prefixes  |                 |
|                       +---------------|---------------+                 |
|                                       |                                 |
|                                       v                                 |
|                       +-------------------------------+                 |
|                       |   VRF: SHARED SERVICES (MGMT) |                 |
|                       |   Export RT: 999:1            |                 |
|                       |   Import RT: 100:1 (Imports)  |                 |
|                       |   Import RT: 200:1 (Imports)  |                 |
|                       +-------------------------------+                 |
+-------------------------------------------------------------------------+

Export and Import Actions

• Export Route Target (route-target export <RT>): When a local VRF route is injected into BGP, the router attaches the specified Route Target community to the VPNv4 advertisement.
• Import Route Target (route-target import <RT>): When a router receives VPNv4 advertisements, it inspects the attached RT communities. If an attached RT matches the VRF's configured import list, the route is converted back to IPv4 and installed into that VRF's RIB/FIB.

Summary: Route Distinguisher vs. Route Target

---

5. VRF Route Leaking Architectures

In enterprise networks, tenants in separate VRFs often need to access shared corporate infrastructure (e.g., DNS, NTP, Active Directory, Internet Proxy, or Centralized Firewalls) without collapsing the entire multi-tenant separation. This controlled sharing is called Inter-VRF Route Leaking.

Method 1: Inter-VRF Static Route Leaking

Static route leaking injects specific prefixes between VRFs using explicit next-hop interfaces or global IP pointers.

Mandatory Rule for Static Leaking: Route leaking must be bidirectional. If VRF RED has a leaked route pointing to the Shared Services subnet, the Shared Services VRF (or global table) must also have a return route pointing back to the VRF RED subnet.

! Route from VRF RED to reach Shared Services subnet 192.168.50.0/24 via Global interface
ip route vrf RED 192.168.50.0 255.255.255.0 GigabitEthernet0/0/2 10.1.50.2

! Return route from Global routing table back to VRF RED subnet 10.1.10.0/24
ip route 10.1.10.0 255.255.255.0 vrf RED 10.1.10.1

Method 2: BGP / MP-BGP Route-Target Leaking

In modern Cisco IOS-XE deployments, BGP automatically leaks prefixes between VRFs on the same physical router by matching Route Target import and export statements under the respective VRF definitions:

vrf definition RED
 rd 65001:10
 address-family ipv4
  route-target export 65001:10
  route-target import 65001:10
  route-target import 65001:99   ! Import shared services routes
 exit-address-family
!
vrf definition SHARED_SERVICES
 rd 65001:99
 address-family ipv4
  route-target export 65001:99
  route-target import 65001:99
  route-target import 65001:10   ! Import tenant RED routes
 exit-address-family

---

6. Cisco IOS-XE Multi-VRF Configuration & Verification

The following configuration demonstrates modern Multi-Protocol VRF (vrf definition), interface binding, per-VRF OSPF routing, and verification.

! Step 1: Define Multi-Protocol VRFs with RD and RT
vrf definition TENANT_A
 description Corporate Production Network
 rd 65001:100
 address-family ipv4
  route-target export 65001:100
  route-target import 65001:100
 exit-address-family
!
vrf definition TENANT_B
 description Guest and Contractor Network
 rd 65001:200
 address-family ipv4
  route-target export 65001:200
  route-target import 65001:200
 exit-address-family
!
! Step 2: Assign sub-interfaces to VRFs (Note: assign VRF BEFORE configuring IP address)
interface GigabitEthernet0/0/1.10
 description TENANT_A Sub-interface
 encapsulation dot1Q 10
 vrf forwarding TENANT_A
 ip address 10.1.10.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/0/1.20
 description TENANT_B Sub-interface
 encapsulation dot1Q 20
 vrf forwarding TENANT_B
 ip address 10.1.20.1 255.255.255.0
 no shutdown
!
! Step 3: Configure Multi-Instance OSPF per VRF
router ospf 100 vrf TENANT_A
 router-id 10.1.10.1
 network 10.1.10.0 0.0.0.255 area 0
!
router ospf 200 vrf TENANT_B
 router-id 10.1.20.1
 network 10.1.20.0 0.0.0.255 area 0

Multi-VRF Verification Commands

! Verify all configured VRFs and their interface bindings
Switch# show vrf
  Name                             Default RD            Protocols   Interfaces
  TENANT_A                         65001:100             ipv4        Gi0/0/1.10
  TENANT_B                         65001:200             ipv4        Gi0/0/1.20

! View routing table for a specific VRF
Switch# show ip route vrf TENANT_A
Routing Table: TENANT_A
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       O - OSPF, IA - OSPF inter area, N1 - OSPF NSSA external type 1

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.10.0/24 is directly connected, GigabitEthernet0/0/1.10
O        10.1.50.0/24 [110/2] via 10.1.10.2, 00:14:22, GigabitEthernet0/0/1.10

! Test connectivity within a specific VRF
Switch# ping vrf TENANT_A 10.1.50.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.50.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms